The Thrive Product Manager plugin for WordPress is vulnerable to broken access control, which may permit unauthenticated attackers to perform unauthorized operations.

The plugin lacks proper authorization checks (CWE-862), allowing unauthenticated users to interact with sensitive functions. The CVSS vector confirms that no authentication is required (PR:N) and the attack complexity is low (AC:L).

An attacker can exploit this vulnerability to execute unintended actions within the Thrive Product Manager interface, potentially leading to unauthorized configuration changes or data exposure. The CVSS score of 7.3 highlights the high risk posed to the operational integrity of the WordPress site.

Immediate Action: Update the Thrive Product Manager plugin to version 10.9.2.1 or later to implement missing capability checks.

Proactive Monitoring: Monitor site activity logs for unauthorized plugin configuration changes or irregular access to the Thrive Product Manager dashboard.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and block attempts to access plugin-specific administrative endpoints without proper authorization.

Public Exploit Available: No

This vulnerability presents a high risk due to the ease of exploitation. Security teams should immediately apply the available patch to ensure that access control logic is correctly enforced for all plugin functions.